fusion-framework/.github/workflows/ci.yml at main · equinor/fusion-framework · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
name: ci

on:
  push:
    branches:
      - main

concurrency: ${{ github.workflow }}-${{ github.ref }}

# Security: Apply principle of least privilege
# This workflow handles package publishing and documentation generation
# - release-pkg: Needs write access to create releases and publish packages
# - documentation: Uses dispatched workflow with minimal required permissions
permissions:
  contents: write  # Required for creating releases and publishing packages
  packages: write  # Required for publishing to npm
  id-token: write  # Required for OIDC token generation

jobs:
  release-pkg:
    name: Version or publish packages
    runs-on: ubuntu-latest
    # Job-specific permissions for package publishing
    permissions:
      contents: write      # Required for creating releases and pushing changes
      packages: write      # Required for publishing to npm registry
      id-token: write      # Required for OIDC token generation
      pull-requests: write # Required for changesets action to create PRs
    outputs:
      published: ${{ steps.changesets.outputs.published }}
      hasChangesets: ${{ steps.changesets.outputs.hasChangesets }}
    steps:
      # Checkout repository with full history for changeset processing
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      # Configure git user for commits made by the workflow
      - name: Configure git user (trigger actor)
        uses: ./.github/actions/config-git-user

      # Install dependencies and setup Node.js environment
      - name: Setup node and install deps
        uses: ./.github/actions/node-setup

      # Process changesets: create version PR or publish packages to npm
      # This step requires write permissions to create releases and publish packages
      - name: Create Release Pull Request or Publish to npm
        id: changesets
        uses: changesets/action@v1
        with:
          title: '🤖 Bip Bop - Fusion Framework Release'
          createGithubReleases: true
          setupGitUser: false
          version: pnpm changeset:version
          publish: pnpm changeset:publish
        env:
          GITHUB_TOKEN: ${{ github.token }}
          NPM_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}

      # Convert changeset PR to draft to prevent accidental merging
      - name: convert Changeset PR to draft
        if: steps.changesets.outputs.published == 'false' && steps.changesets.outputs.pullRequestNumber
        run: gh pr ready ${{ steps.changesets.outputs.pullRequestNumber }} --undo
        env:
          GH_TOKEN: ${{ github.token }}

  # Update documentation only when packages are published
  # Uses dispatched workflow with minimal required permissions
  documentation:
    name: Update documentation
    permissions:
      contents: read   # Required to read repository contents
      pages: write     # Required to deploy to GitHub Pages
      id-token: write  # Required for OIDC token generation
    needs: release-pkg
    if: needs.release-pkg.outputs.published == 'true'
    uses: ./.github/workflows/generate-docs.yml
    secrets: inherit

  # Index documentation on package release
  index-docs:
    name: Index documentation
    permissions:
      contents: write
      id-token: write
    needs: release-pkg
    if: needs.release-pkg.outputs.published == 'true'
    uses: ./.github/workflows/index-docs.yml
    with:
      environment: docs
    secrets: inherit